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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide an illegal operation 
monitor device capable of monitoring any illegal input and operation 
in real time by always monitoring the operation history log of a 
computer system to be monitored. 

SOLUTION: This illegal operation monitor device 3 is provided 
with an operation history log information acquiring means 1 1 for 
acquiring operation history log information from a computer system 
2 to be monitored, an operation history log memory 12 for storing 
the operation history log information, an illegality discovery 
information registering means 13 for registering illegal discovery 
information for discovering any illegal operation, an input 
information memory 14 for storing input information such as a key 
input interval or an input alarm value being the illegality discovery 
information, an operation pattern information memory 15 for storing 
operation pattern information being the illegality discovery 
information, and an illegal operation monitoring means 16 for 
monitoring the illegal operation by comparing the illegality 
discovery information with operation history log information. 
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